Should My Business Switch From Passwords to Passkeys?
Should my business switch from passwords to passkeys?
For the accounts that matter most, yes, wherever they're offered. You don't have to switch everything at once, and you won't be able to anyway, since not every website offers them yet. But the handful of accounts that run your business are worth ten minutes this week.
What is a passkey?
A passkey lets you sign in with your face, your fingerprint or your phone's PIN instead of a password, the same way you already unlock your phone.
When you set one up, your phone makes a secret key that never leaves the phone, and the website only gets the matching half. When you sign in, the two halves have to fit. Nothing gets typed and nothing secret gets sent.
Why is that safer for a business?
Because a passkey only works on the real website it was made for.
The most common way a business account gets stolen is a fake login page. An email says your account is locked or an invoice is waiting, somebody clicks, and they land on a page that looks exactly like Microsoft or Google. They type in the password and it's gone.
With a passkey, there's nothing to type. If a fake Microsoft page asks the phone for the passkey, the phone won't hand it over, because the page isn't Microsoft. So even when somebody on your team clicks the wrong link on a busy Monday, there's nothing to give away.
And when a big company gets hacked, there's no password sitting on their end to steal.
Why now?
The holidays are when fake order and shipping emails pile up, because everybody's ordering everything and nobody thinks twice about an email from Amazon. In the fall of 2026 we also watched scammers send our own clients fake emails with my name on them. Those were after money. Going after logins is the obvious next step. (For spotting a fake in the first place, see How Can You Tell Who an Email Is Really From?)
How do I set one up?
Log in the way you normally do, go into your account or security settings, look for "passkey," and follow the steps. Your phone asks for your face, fingerprint or PIN, and that's it. I set one up myself and it was not a big deal.
Your face and fingerprint never leave your phone. The website never sees them.
What can't a passkey do?
It doesn't fix everything, and anybody who tells you a single setting makes you safe is selling something.
Passwords aren't going away, because plenty of websites don't offer passkeys yet. A virus on a computer is still a virus. And a passkey does nothing about a scam that asks you to pay an invoice instead of log in. For those, call the company at a number you already have, never the one in the email.
Frequently asked questions
What if an employee needs to get into the same account?
Where the service allows it, give each person their own login instead of sharing one. Many business accounts, including Google and Microsoft, also let one account hold more than one passkey. Shared passwords are how a former employee still has access two years later.
What happens if I lose my phone?
On an iPhone your passkeys are kept in your iCloud account, and on Android they're kept in your Google account, so they come back when you sign in on the new phone. Most sites also still let you sign in another way.
Do I need a new phone?
Probably not. If your phone unlocks with your face or fingerprint, it very likely supports passkeys.
Which accounts should I start with?
Your email first, if it offers passkeys, because whoever gets into your email can reset almost everything else. If we host your email, it doesn't offer passkeys yet, so a strong, unique password plus a phone call before you click anything is the defense there. We wrote a whole post on the order to go in.
Let's talk
If an email about your website or your accounts ever doesn't feel right, call me at 979-217-1544 before you do anything with it.
Tom Bruch has built websites since 1998 and is the owner of Aggieland Website Design.